APP 7 direct marketing: consent, opt-out & when you can't message (2026)
APP 7 restricts using or disclosing personal information for direct marketing and requires a simple opt-out — when it applies, the exceptions and penalties.
Who must comply
APP entities engaged in direct marketing.
What triggers it
Using personal info for direct marketing.
When due
Continuous.
Evidence required
Consent records; opt-out mechanism + register; marketing-list audit trail.
Max penalty
Same penalty regime as other Privacy Act breaches; $50M / 30% turnover max
Summary
APP 7 of the Privacy Act restricts use of personal information for direct marketing. Mandatory opt-out + handling of requests to opt out; simplified consent regime for personal info collected directly.
Enforced by
Source legislation
Topics
Related obligations
- CWLTHAPP 3 collection of sensitive informationAPP 3 bars collecting sensitive information — health, race, religion, sexual orientation and more — without consent. What counts as sensitive, the exceptions and penalties.
- CWLTHProvide an APP 5 collection notice at or before collectionAPP 5 requires notice of identity, purposes, recipients, consequences of not providing info, and where Privacy Policy lives.
- CWLTHAPP 8 cross-border disclosureBefore disclosing personal information overseas, APP 8 requires reasonable steps so the recipient meets the APPs — unless an exception applies. Steps and exceptions.
- CWLTHAPP 12 & APP 13 access and correction requestsIndividuals can ask to access (APP 12) and correct (APP 13) the personal information you hold — the strict response times, allowable refusals and how to comply.
- CWLTHPublish a Privacy Policy compliant with APP 1Every APP entity needs a clearly-expressed Privacy Policy covering APP 1.4 requirements.
- CWLTHAPP 2 — anonymity + pseudonymity for individualsWhere reasonable, individuals must be able to deal with you anonymously or under a pseudonym.
Frequently asked questions
- Who must comply with APP 7 direct marketing: consent, opt-out & when you can't message (2026)?
- APP entities engaged in direct marketing.
- What triggers APP 7 direct marketing: consent, opt-out & when you can't message (2026)?
- Using personal info for direct marketing.
- When is APP 7 direct marketing: consent, opt-out & when you can't message (2026) due?
- Continuous.
- What is the maximum penalty for APP 7 direct marketing: consent, opt-out & when you can't message (2026)?
- Same penalty regime as other Privacy Act breaches; $50M / 30% turnover max
- What evidence is required for APP 7 direct marketing: consent, opt-out & when you can't message (2026)?
- Consent records; opt-out mechanism + register; marketing-list audit trail.
Source: https://oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-7-app-7-direct-marketing. Rules Mate is not a law firm. Always verify against the live regulator source before acting.